{{- else }}
    service:
      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
      namespace: {{ .namespace }}
      path: "{{ .injectionPath }}"
      port: 443
    {{- end }}
  sideEffects: None
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  failurePolicy: Fail
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}

      - canary
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
---
# same webhook but with different name, will result in a duplicate
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  labels:

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 11;

  // SideEffects states whether this webhook has side effects.
  // Acceptable values are: Unknown, None, Some, NoneOnDryRun
  // Webhooks with side effects MUST implement a reconciliation system, since a request may be
  // rejected by a future step in the admission chain and the side effects therefore need to be undone.

    PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
    VERIFY_CERTIFICATE_AT_CLIENT: "false"
    ENABLE_AUTO_SNI: "false"

    # 1.22 behavioral changes
    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"

meshConfig:
  # 1.22 behavioral changes
  defaultConfig:
    proxyMetadata:
      ISTIO_DELTA_XDS: "false"
    tracing:
      zipkin:

    PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
    VERIFY_CERTIFICATE_AT_CLIENT: "false"
    ENABLE_AUTO_SNI: "false"

    # 1.22 behavioral changes
    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"

meshConfig:
  # 1.22 behavioral changes
  defaultConfig:
    proxyMetadata:
      ISTIO_DELTA_XDS: "false"
    tracing:
      zipkin:

    PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
    VERIFY_CERTIFICATE_AT_CLIENT: "false"
    ENABLE_AUTO_SNI: "false"

    # 1.22 behavioral changes
    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"

meshConfig:
  # 1.22 behavioral changes
  defaultConfig:
    proxyMetadata:
      ISTIO_DELTA_XDS: "false"
    tracing:
      zipkin:

# If you want to make a change in this file, edit the original one and run "make gen".

pilot:
  env:
    # 1.22 behavioral changes
    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
meshConfig:
  # 1.22 behavioral changes
  proxyMetadata:
    ISTIO_DELTA_XDS: "false"
  defaultConfig:
    tracing:
      zipkin:

	switch request.Method {
	case http.MethodGet:
		_, _ = writer.Write([]byte(getResponse))
	}
}

func adsHandler(writer http.ResponseWriter, request *http.Request) {
	const getResponse = `{"name":"ads","description":"ads debugging","output_level":"info","stack_trace_level":"none","log_callers":false}`

	switch request.Method {

    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    {{- end }}
    sideEffects: None
    admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}

    "ci.pipeline.run.id=${PROW_JOB_ID},"\
    "ci.pipeline.run.repo=${REPO_OWNER:-unknown}/${REPO_NAME:-unknown},"\
    "ci.pipeline.run.base=${PULL_BASE_REF:-none},"\
    "ci.pipeline.run.pull_number=${PULL_NUMBER:-none},"\
    "ci.pipeline.run.pull_sha=${PULL_PULL_SHA:-${PULL_BASE_SHA:-none}}"
}

# Usage: tracing::run <span name> [command ...]
function tracing::run() {